Free CISSP sample questions

Correct answer: Determine the risk of a business interruption occurring

This is the CORRECT answer. A Business Impact Analysis (BIA) questionnaire should NOT include questions about determining the risk of a business interruption occurring. The BIA focuses on identifying and quantifying the impacts of business disruptions, not on assessing the likelihood or risk of those disruptions occurring. Risk assessment is a separate process that typically precedes or runs parallel to the BIA. The BIA should focus on impact identification, quantification of financial and operational losses, and recovery time objectives.

Correct answer: Purge or re-image the hard disk drive

This is the CORRECT answer. Purging or re-imaging the hard disk drive before traveling to a high-risk area is the most effective way to reduce risk. This ensures that if the laptop is stolen, compromised, or subjected to border inspection, no sensitive organizational data can be accessed. Only essential software and data needed for the trip should be loaded onto the device.

Correct answer: Backup tapes are generated unencrypted

This is the CORRECT answer. Backup tapes generated unencrypted represent the GREATEST risk to data confidentiality. If these tapes are lost, stolen, or improperly disposed of, all the sensitive data they contain becomes immediately accessible to unauthorized parties. Backup tapes often contain complete copies of critical databases and systems, making their compromise catastrophic for confidentiality. Other options may pose risks but none as severe and direct as unencrypted data at rest.

Correct answer: Conduct a gap analysis of a new facilities against existing security requirements

This is the CORRECT answer. From a data security perspective, conducting a gap analysis of the new facilities against existing security requirements is the most important consideration. This analysis will identify what security controls need to be implemented, upgraded, or modified in the new location to maintain the same level of data protection. It ensures that data classification requirements, access controls, physical security, and environmental protections are properly addressed in the new facility.

Correct answer: Application

This is the CORRECT answer. In a Tier 4 data center, application failures should be the primary concern for the IT manager during BCP planning. Tier 4 data centers provide fault-tolerant infrastructure with 99.995% uptime, redundant power, cooling, and network systems. Since the infrastructure is highly resilient, application-level failures become the most likely cause of service disruption that BCP must address.

Correct answer: Only when standards are defined

This is the CORRECT answer. According to ISO 27001 and 27002, management responsibilities can only be defined when standards are established. The standards provide the framework and requirements that determine what management responsibilities are needed for information security governance. Without standards defining the security requirements and controls, it is impossible to assign appropriate management responsibilities.

Correct answer: Hire a guard to protect the public area

This is the CORRECT answer. Hiring a guard to protect the public area is the most cost-effective reactive control for protecting personnel in public areas. A reactive control responds to incidents as they occur, and a security guard can immediately respond to threats, incidents, or emergencies involving personnel or visitors. This human control provides flexibility, judgment, and real-time response capabilities that automated systems cannot match. The other options are either preventive controls (mantraps, enclosures) or require more expensive infrastructure investments compared to hiring security personnel. Guards can also serve multiple functions including access control, emergency response, and incident reporting, making them highly cost-effective for public area protection.

Correct answer: People, technology, and operations

This is the CORRECT answer. Defense in depth requires a balanced focus on People, Technology, and Operations as the three PRIMARY elements. This concept, fundamental to CISSP Security Architecture domain, recognizes that effective security cannot be achieved through technology alone. People include security awareness, training, and proper procedures. Technology encompasses the security tools and controls. Operations involve the processes, procedures, and management practices that tie everything together. The other options represent phases or activities within security programs but are not the foundational elements of defense in depth strategy. Reference: https://www.giac.org/paper/gsec/3873/information-warfare-cyber-warfare-future-warfare/106165

Correct answer: Right of the owner to control delivery method

This is the CORRECT answer. Intellectual property rights are primarily concerned with the right of the owner to control the delivery method of their creation. This relates to the CISSP Legal and Compliance domain, covering how intellectual property can be distributed, accessed, and used. Control over delivery method encompasses licensing terms, distribution channels, access restrictions, and usage limitations. While financial gain and copyright maintenance are important considerations, the fundamental right is about controlling how the intellectual property reaches and is used by others. This control ensures the owner can enforce licensing agreements, prevent unauthorized distribution, and maintain the integrity of their intellectual creation.

Correct answer: 25%

This is the CORRECT answer. The residual risk is 25%. This question tests quantitative risk analysis from the CISSP Security Assessment domain. To calculate residual risk: First, the control stops 50% of attacks, so 50% still occur. Of those attacks that do occur (50%), the impact is reduced by 50%, meaning only 50% of the original impact remains. Therefore: 50% (attacks that occur) × 50% (remaining impact) = 25% residual risk. This calculation demonstrates how layered controls work together - prevention controls reduce likelihood while impact reduction controls minimize damage when prevention fails. Understanding residual risk calculations is essential for risk management and justifying security investments.